Your Data and Privacy with Merton Flowers

Merton Flowers Privacy Policy

Introduction

This Privacy Policy explains how Merton Flowers ("we", "our" or "us") collects, uses, retains, and safeguards your personal data in line with the General Data Protection Regulation (GDPR) and relevant UK data protection laws. This policy applies to all individuals placing orders for goods or services from Merton Flowers within Merton and its surrounding districts. By using our services, you acknowledge and agree to the practices described herein.

What Data We Collect

When you place an order or interact with us, Merton Flowers may collect the following categories of personal data:

Identity Data: such as your full name, delivery recipient’s name (if different), and title.
Contact Data: including billing and delivery addresses, telephone numbers, and information necessary to process communications regarding your order.
Transaction Data: details of orders placed, payment information (card type and limited payment details, never full card numbers or security codes), and records of purchases.
Correspondence Data: records of your communications with us (by phone, written messages, or in person), including notes on special requests and order preferences.
Technical Data: such as IP addresses, browser type, device identifiers, and information about your device’s interaction with our website (for online orders and general site security).

Lawful Basis for Processing Your Data

Under GDPR, Merton Flowers processes your personal data on various lawful bases, including:

Contractual Necessity: To fulfil our contract with you and process orders, payments, and deliveries as requested.
Legitimate Interests: To manage our operations efficiently, respond to customer service enquiries, improve our offerings, and in rare cases, to detect and prevent fraud or misuse of our services.
Legal Obligation: To comply with laws and regulations that apply to us as a business, including recordkeeping and tax compliance.
Consent: If you opt-in to marketing communications, we process your data based on your explicit consent. You can withdraw consent at any time.

How We Use Your Information

Your personal data is used for the following purposes:

To process and fulfil your floral order, including delivery to the correct address and communication regarding delivery updates or issues.
To manage payments, respond to questions or complaints, and deliver customer support.
To improve our services, analyse purchasing trends (on a non-identifiable basis), and enhance your experience.
If consented, to send you service updates, news, or marketing information regarding our floral products and promotions (you can unsubscribe at any time).

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. In most cases, data associated with orders and transactions is retained for up to seven years following your last order to comply with UK tax and regulatory requirements. After this time, personal data is securely deleted or anonymised. If we have obtained your consent for marketing, that data will be retained until you withdraw your consent or request deletion.

Processors and Third Parties

Merton Flowers may share your data with trusted third-party service providers (known as "processors") who support our business. These include:

Payment processing and fraud prevention platforms.
Courier and postal services that deliver your flowers.
Cloud-based services for secure storage and operational support.
Professional advisors (accountants, legal advisors) where required for business operations.

All processors are contractually required to process your personal data exclusively for the stated purposes, according to our instructions, and with appropriate security measures in place. We do not sell, rent, or trade your data with other companies for their independent marketing purposes.

Your Rights as a Data Subject

Under GDPR and UK law, you have the following rights regarding your personal data:

Right of Access: You may request a copy of your personal information held by us.
Right to Rectification: You can ask us to correct or update inaccurate data.
Right to Erasure: In certain cases, you can request deletion of your data ("right to be forgotten").
Right to Restrict Processing: You have the right to request restriction or suppression of your data processing, under certain conditions.
Right to Data Portability: Where applicable, request transfer of your data to you or another service provider in a structured, commonly used format.
Right to Withdraw Consent: If processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing prior to withdrawal.
Right to Object: To processing where we rely on legitimate interests, including for marketing purposes.

To exercise any of these rights, please contact us using the contact information provided on our website or at our business premises. We may request proof of identity to ensure the security of your personal data before acting on your request.

Data Security

Merton Flowers has implemented appropriate security measures to protect your data from accidental loss, misuse, unauthorised access, alteration, or disclosure. All personal data is stored securely, whether in physical or digital form, and access is limited strictly to those employees, agents or processors who need it to perform their duties.

International Data Transfers

In rare instances where your data may be transferred and processed outside the United Kingdom, we ensure that appropriate safeguards are in place in accordance with GDPR requirements, such as ensuring the country provides adequate protection or contractual clauses approved by relevant authorities.

Changes to this Privacy Policy

We may periodically update this Privacy Policy to reflect changes in our practices, operational requirements, or legal and regulatory developments. The most recent version of the Privacy Policy will always apply to your data and is available on our website or upon request. We recommend reviewing this policy regularly to stay informed about how we protect your privacy.

Contact and Concerns

If you have any concerns or questions regarding this Privacy Policy or our handling of your personal information, you have the right to lodge a complaint with the relevant supervisory authority, or you may contact us directly through the details published on our website or at our business address.